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IN THE SPECIFICATION: 

Please replace page 4 with the following text: 

It will be understood that control units 272 and 250 are only separated to demonstrate 
conformance to the known FlexRay™ architecture, and may otherwise be commonly 
provided. 

The node guardian 200 protects the receiver of the communication processor against 
jabbering nodes by enabling and disabling the respective switches according to a static 
TDMA schedule (which will be understood and need not be described in further detail). 

The node guardian 200 implements an input protection boundary, which means it may 
share the same clock, power supply, etc., with the communication processor 280. 
Another ke y difference compared to the bus guardian approach is that with the node 
guardian 280 protection occurs outside of the sphere of the faulty node and within the 
sphere of the fault-free device. 

FIG. 3 shows an example of a hierarchical distributed processing network system 
system developed from the purely bus guardian based system of FIG. 1 and utilising the 
bus guardian arrangement 200 of FIG. 2. In the system 300 of FIG. 3, nodes 310, 320, 
330, 360, 370 and 380 implement the bus guardian approach as in the system of 
FIG. 1 , while two nodes 340 and 350 each incorporate the arrangement 200 of FIG. 2 in 
341 and 351 and are based on the node guardian approach. The nodes 310, 320 and 
330 are coupled via a common channel 390 to the node 340 and constitute error 
containment region 301 , and are also coupled via the channel 390 to the node 350. The 
nodes 360, 370 and 380 are coupled via a common channel 395 to the node 350 and 
constitute an error containment region 302, and are also coupled via the channel 395 to 
the node 340. The node 340 is coupled to the node 350 via path 393, and the node 350 
is coupled to the node 340 via path 398. Path 393 enables node 340 to communicate 
with node 350 even if a jabbering fault in node 31 0, 320 or 330 has penetrated past the 
respective bus guardian 31 1 , 34 ^321 or 34 ^331 and blocked channel 390. Path 398 
serves in a corresponding way for node 350. In the system of FIG. 3, a fault occurring in 
error containment region 301 (i.e., nodes 310, 320, 330 or 340) is confined to region 
301 (fault propagation path a and x1) and cannot impact the nodes in error containment 



-2- 



SC12401EM 



region 302. The same holds true vice versa for faults originating in error containment 
region 302. Hence, a clear concept of confinement is implemented. 
FIG. 4 shows an improved version of the example shown in FIG. 3 that makes use of 
the dual channel capabilities provided in particular by FlexRay™. Additionally to the 
system of 
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